Can confirm the principle of least surprise being violated here. It took me
getting a permission error trying to replace a file to test a bugfix to realize
that:
- Commands without explicit permission elevation do system-wide modifications
- A theoretically user level setup is not fully covered
Status changed to 'Confirmed' because the bug affects multiple users.
** Changed in: flatpak (Ubuntu)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1943480
Title:
With Debian maintainer hat on, I'm willing to have a limited amount of
DEB_VENDOR conditionalization in the Debian packaging, like the way we
used to compile xdg-desktop-portal with --disable-pipewire before
pipewire was available in Ubuntu main.
However, I draw the line at applying
I would recommend that Ubuntu either uses the Debian package as-is, or
branches from the Debian packaging to apply whatever divergence is
desired. I'd be happy to let Ubuntu maintainers of flatpak use the
`ubuntu/*` namespace on Salsa for this, similar to how gnome-shell is
packaged.
Obviously
Yes the security team favors both consistency and the principle of least
surprise for users here - ie. flatpak should follow the same model as
apt/snaps on Ubuntu so that no matter what mechanism is used to install
a particular application, the user gets the same consistent experience
in terms of
This bug is part of the security team's process -- I know I'm in favor
of standardizing flatpak's rules to match apt and snap so the experience
is consistent across Ubuntu.
Alex? Marc? et al?
Thanks
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is
Thank you Seth for raising this.
For clarity on the current status of this, the decision-making part of
what is appropriate to do in Ubuntu here has been delegated by the
Technical Board to the Ubuntu Security Team:
https://irclogs.ubuntu.com/2021/09/14/%23ubuntu-meeting.html#t19:17
--
You
